topic Re: Why are logs not being forwarded after installing the universal forwarder on Linux machineRHEL? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Why-are-logs-not-being-forwarded-after-installing-the-universal/m-p/114992#M24062 <P>on client:</P> <P>/opt/splunkforwarder/bin/splunk start<BR /> The splunk daemon (splunkd) is already running. </P> <P>on server also is running, i have 230 hosts sending logs on splunk.<BR /> also in this case i am monitoring /var/log/<BR /> i think i followed all the instructions.</P> Mon, 10 Nov 2014 15:30:18 GMT blebit 2014-11-10T15:30:18Z Why are logs not being forwarded after installing the universal forwarder on Linux machineRHEL? https://community.splunk.com/t5/Getting-Data-In/Why-are-logs-not-being-forwarded-after-installing-the-universal/m-p/114987#M24057 <P>hi all,</P> <P>after installing splunk universal forwarder on linux machine RHEL i have this message after ./splunk list forward-server :<BR /> Active forwards:<BR /> None<BR /> Configured but inactive forwards:<BR /> x.x.x.x:9997<BR /> but i checked firewall and it is ok.</P> <P>Connection to x.x.x.x 9997 port [tcp/palace-6] succeeded!<BR /> But logs are not going on splunk server<BR /> universalforwarder version: splunkforwarder-6.1.4-233537-linux-2.6-x86_64.rpm</P> <P>what might be the problem?<BR /> thanks</P> Mon, 10 Nov 2014 14:14:37 GMT https://community.splunk.com/t5/Getting-Data-In/Why-are-logs-not-being-forwarded-after-installing-the-universal/m-p/114987#M24057 blebit 2014-11-10T14:14:37Z Re: Why are logs not being forwarded after installing the universal forwarder on Linux machineRHEL? https://community.splunk.com/t5/Getting-Data-In/Why-are-logs-not-being-forwarded-after-installing-the-universal/m-p/114988#M24058 <P>Did you enable Receiving on the Splunk Server, which is supposed to get the logs forwarded by UF?</P> Mon, 10 Nov 2014 14:42:37 GMT https://community.splunk.com/t5/Getting-Data-In/Why-are-logs-not-being-forwarded-after-installing-the-universal/m-p/114988#M24058 Raghav2384 2014-11-10T14:42:37Z Re: Why are logs not being forwarded after installing the universal forwarder on Linux machineRHEL? https://community.splunk.com/t5/Getting-Data-In/Why-are-logs-not-being-forwarded-after-installing-the-universal/m-p/114989#M24059 <P>yes, because i am receiving from other linux hosts</P> Mon, 10 Nov 2014 15:00:51 GMT https://community.splunk.com/t5/Getting-Data-In/Why-are-logs-not-being-forwarded-after-installing-the-universal/m-p/114989#M24059 blebit 2014-11-10T15:00:51Z Re: Why are logs not being forwarded after installing the universal forwarder on Linux machineRHEL? https://community.splunk.com/t5/Getting-Data-In/Why-are-logs-not-being-forwarded-after-installing-the-universal/m-p/114990#M24060 <P>What version is your indexer/heavy forwarder doing the receiving?</P> Mon, 10 Nov 2014 15:12:51 GMT https://community.splunk.com/t5/Getting-Data-In/Why-are-logs-not-being-forwarded-after-installing-the-universal/m-p/114990#M24060 grijhwani 2014-11-10T15:12:51Z Re: Why are logs not being forwarded after installing the universal forwarder on Linux machineRHEL? https://community.splunk.com/t5/Getting-Data-In/Why-are-logs-not-being-forwarded-after-installing-the-universal/m-p/114991#M24061 <P>Interesting, Just did a UF install. Created some Monitor stanzas in inputs.conf and mentioned server in the outputs.conf. I see the server address after forwards: x.x.x.x. Is the splunkd running on the splunk server <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> (Please don't yell at me for asking this). Reason why i ask, i get forward : none after i intentionally stopped splunkd on Splunk server.</P> Mon, 10 Nov 2014 15:21:47 GMT https://community.splunk.com/t5/Getting-Data-In/Why-are-logs-not-being-forwarded-after-installing-the-universal/m-p/114991#M24061 Raghav2384 2014-11-10T15:21:47Z Re: Why are logs not being forwarded after installing the universal forwarder on Linux machineRHEL? https://community.splunk.com/t5/Getting-Data-In/Why-are-logs-not-being-forwarded-after-installing-the-universal/m-p/114992#M24062 <P>on client:</P> <P>/opt/splunkforwarder/bin/splunk start<BR /> The splunk daemon (splunkd) is already running. </P> <P>on server also is running, i have 230 hosts sending logs on splunk.<BR /> also in this case i am monitoring /var/log/<BR /> i think i followed all the instructions.</P> Mon, 10 Nov 2014 15:30:18 GMT https://community.splunk.com/t5/Getting-Data-In/Why-are-logs-not-being-forwarded-after-installing-the-universal/m-p/114992#M24062 blebit 2014-11-10T15:30:18Z Re: Why are logs not being forwarded after installing the universal forwarder on Linux machineRHEL? https://community.splunk.com/t5/Getting-Data-In/Why-are-logs-not-being-forwarded-after-installing-the-universal/m-p/114993#M24063 <P>splunk server: 6.1.2 on centOS</P> Mon, 10 Nov 2014 15:31:03 GMT https://community.splunk.com/t5/Getting-Data-In/Why-are-logs-not-being-forwarded-after-installing-the-universal/m-p/114993#M24063 blebit 2014-11-10T15:31:03Z